CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1CVE-2019-14837 – keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure
https://notcve.org/view.php?id=CVE-2019-14837
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'. Se encontró un fallo en keycloack versiones anteriores a la versión 8.0.0. El propietario del dominio "placeholder.org" puede configurar el servidor de correo sobre este dominio y conociendo solo el nombre de un cliente puede restablecer la contraseña y luego iniciar sesión. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14837 https://github.com/keycloak/keycloak/commit/9a7c1a91a59ab85e7f8889a505be04a71580777f https://issues.jboss.org/browse/KEYCLOAK-10780 https://access.redhat.com/security/cve/CVE-2019-14837 https://bugzilla.redhat.com/show_bug.cgi?id=1730227 • CWE-547: Use of Hard-coded, Security-relevant Constants CWE-798: Use of Hard-coded Credentials •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3655
https://notcve.org/view.php?id=CVE-2014-3655
JBoss KeyCloak is vulnerable to soft token deletion via CSRF JBoss KeyCloak es vulnerable a la eliminación del token soft por medio de CSRF • https://access.redhat.com/security/cve/cve-2014-3655 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3655 https://snyk.io/vuln/SNYK-JAVA-ORGKEYCLOAK-30138 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14820 – keycloak: adapter endpoints are exposed via arbitrary URLs
https://notcve.org/view.php?id=CVE-2019-14820
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information. Se descubrió que keycloak versiones anteriores la versión 8.0.0, expone los endpoints del adaptador interno en org.keycloak.constants.AdapterConstants, que pueden ser invocadas por medio de una URL especialmente diseñada. Esta vulnerabilidad podría permitir a un atacante acceder a información no autorizada. It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820 https://access.redhat.com/security/cve/CVE-2019-14820 https://bugzilla.redhat.com/show_bug.cgi?id=1649870 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-14832 – keycloak: cross-realm user access auth bypass
https://notcve.org/view.php?id=CVE-2019-14832
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks. Se encontró un fallo en la API REST de Keycloak anterior a la versión 8.0.0, donde se permitiría el acceso del usuario desde un dominio en el que el usuario no fue configurado. Un atacante autenticado con conocimiento de un id de usuario podría usar este fallo para acceder a información no autorizada o llevar a cabo futuros ataques. A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14832 https://access.redhat.com/security/cve/CVE-2019-14832 https://bugzilla.redhat.com/show_bug.cgi?id=1749487 • CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10201 – keycloak: SAML broker does not check existence of signature on document allowing any user impersonation
https://notcve.org/view.php?id=CVE-2019-10201
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information. Se detectó que el broker SAML de Keycloak, versiones hasta 6.0.1, no comprobaba la falta de firmas de mensajes. Si un atacante modifica la Respuesta SAML y elimina las secciones (Signature), el mensaje sigue siendo aceptado y el mensaje puede ser modificado. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201 https://access.redhat.com/security/cve/CVE-2019-10201 https://bugzilla.redhat.com/show_bug.cgi?id=1728609 • CWE-287: Improper Authentication CWE-347: Improper Verification of Cryptographic Signature CWE-592: DEPRECATED: Authentication Bypass Issues •